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Abstract. The circuit evaluation problem (also known as the compressed word 
problem) for finitely generated linear groups is studied. The best upper bound 
for this problem is CORP. which is shown by a reduction to polynomial identity 
testing. Conversely, the compressed word problem for the linear group SL3 (Z) is 
equivalent to polynomial identity testing. In the paper, it is shown that the com¬ 
pressed word problem for every finitely generated nilpotent group is in DET C 
NC 2 . Within the larger class of polycyclic groups we find examples where the 
compressed word problem is at least as hard as polynomial identity testing for 
skew arithmetic circuits. 


1 Introduction 

The study of circuit evaluation problems has a long tradition in theoretical computer 
science and is tightly connected to many aspects in computational complexity theory. 
One of the most important circuit evaluation problems is polynomial identity testing. 
Here, the input is an arithmetic circuit, whose internal gates are labelled with either 
addition or multiplication and its input gates are labelled with variables (x±,X 2 , ■ ■ •) or 
constants (—1,0,1), and it is asked whether the output gate evaluates to the zero poly¬ 
nomial (in this paper, we always work in the polynomial ring over the coefficient ring 
Z or Z p for a prime p). Based on the Schwartz-Zippel-DeMillo-Lipton Lemma, Ibarra 
and Moran GE) proved that polynomial identity testing over Z or Z p belongs to the 
class CORP (the complements of problems in randomized polynomial time). Whether 
there is a deterministic polynomial time algorithm for polynomial identity testing is an 
important problem. In lfl6l it is shown that if there exists a language in DTIME(2 0 ( n )) 
that has circuit complexity 2 ot ' n \ then P = BPP (and hence P = RP = coRP). There 
is also an implication that goes the other way round: Kabanets and Impagliazzo H2l 
have shown that if polynomial identity testing belongs to P, then (i) there is a language 
in NEXPTIME that does not have polynomial size circuits, or (ii) the permanent is not 
computable by polynomial size arithmetic circuits. Both conclusions represent major 
open problem in complexity theory. Hence, although it is quite plausible that polyno¬ 
mial identity testing belongs to P (by nu), it will be probably very hard to prove (by 

mi). 

Circuit evaluation problems can be also studied for other structures than polyno¬ 
mial rings, in particular non-commutative structures. For finite monoids, the circuit 
evaluation problem has been studied in (9), where it was shown using Barrington’s 
technique ||7] that for every non-solvable finite monoid the circuit evaluation problem is 
P-complete, whereas for every solvable monoid, the circuit evaluation problem belongs 
to the parallel complexity class DET C NC 2 . Starting with 11211 the circuit evaluation 


problem has been also studied for infinite finitely generated (f.g) monoids, in particu¬ 
lar infinite f.g. groups. In this context, the input gates of the circuit are labelled with 
generators of the monoid and the internal gates compute the product of the two input 
gates. 

In GTi and subsequent work, the circuit evaluation problem is also called the com¬ 
pressed word problem. This is due to the fact that if one forgets the underlying monoid 
structure of a multiplicative circuit, the circuit simply evaluates to a word over the 
monoid generators labelling the input gates. This word can be of length exponential 
in the number of circuit gates. Hence, the circuit can be seen as a compressed represen¬ 
tation of the word it produces. In this context, circuits are also known as straight-line 
programs (SLPs) and are intensively studied in the area of algorithms for compressed 
data, see ll22l for an overview. 

Concerning the compressed word problem, polynomial time algorithms have been 
developed for many important classes of groups, e.g., finite groups, f.g. nilpotent groups, 
f.g. free groups, graph groups (also known as right-angled Artin groups or partially 
commutative groups), and virtually special groups. The latter contain all Coxeter groups, 
one-relator groups with torsion, fully residually free groups, and fundamental groups of 
hyperbolic 3-manifolds; see Il23l for details. For the important class of f.g. linear groups, 
i.e., f.g. groups of matrices over a held, it was shown in l23l that the compressed word 
problem can be reduced to polynomial identity testing (over Z or Z p , depending on the 
characteristic of the held) and hence belongs to coRP. Vice versa, in ll23l it was shown 
that polynomial identity testing over Z can be reduced to the compressed word problem 
for the linear group SI_ 3 (Z). The proof is based on a construction of Ben-Or and Cleve 
HD- This result indicates that derandomizing the compressed word problem for a f.g. 
linear group will be in general very difficult. 

In this paper, we further investigate the tight correspondence between commutative 
circuits over rings and non-commutative circuits over linear groups. In Section [6] we 
study the complexity of the compressed word problem for f.g. nilpotent groups. For 
these groups, the compressed word problem can be solved in polynomial time ll23l . 
Here, we show that for every f.g. nilpotent group the compressed word problem belongs 
to the parallel complexity class DET C NC 2 , which is the class of all problems that are 
NC 1 -reducible to the computation of the determinant of an integer matrix, see lfl2l . To 
the knowledge of the authors, f.g. nilpotent groups are the only examples of infinite 
groups for which the compressed word problem belongs to NC. Even for free groups, 
the compressed word problem is P-complete ED. The main step of our proof for f.g. 
nilpotent groups is to show that for a torsion-free f.g. nilpotent group G the compressed 
word problem belongs to the logspace counting class C = L (and is in fact C = L-complete 
if G is nontrivial). To show this, we use the well-known fact that a f.g. torsion-free 
nilpotent group can be embedded into the group UT^Z) of (/-dimensional uni triangular 
matrices over Z for some fixed d. Then, the compressed word problem for UT,/(Z) is 
reduced to the question whether two additive circuits over the natural numbers evaluate 
to the same number, which is C = L-complete. Let us mention that there are several C = L- 
complete problems related to linear algebra El- 

We also study the compressed word problem for the matrix group UTd(Z) for the 
case that the dimension d is not fixed, i.e., part of the input (SectionlT}. In this case, the 
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compressed word problem turns out to be complete for the counting class C = LogCFL, 
which is the LogCFL-analogue of C = L. 

Finally, in Section [8] we move from nilpotent groups to polycyclic groups. These 
are solvable groups, where every subgroup is finitely generated. By results of Maltsev, 
Auslander, and Swan these are exactly the solvable subgroups of GL,/(Z) for some d. 
We prove that polynomial identity testing for skew arithmetic circuits reduces to the 
compressed word problem for a specific 2-generator polycyclic group of Hirsch length 
3. A skew arithmetic circuit is an arithmetic circuit (as defined in the first paragraph 
of the introduction) such that for every multiplication gate, one of its input gates is an 
input gate of the circuit, i.e., a variable or a constant. These circuits exactly correspond 
to algebraic branching programs. Even for skew arithmetic circuits, no polynomial time 
algorithm is currently known (although the problem belongs to coRNC). 

2 arithmetic circuits 

We use the standard notion of (division-free) arithmetic circuits. Let us fix a set X = 
{xi,X 2 ,...} of variables. An arithmetic circuit is a triple C = (V, S , rhs) with the 
following properties: 

- V is a finite set of gates. 

- S £ V is the output gate. 

- For every gate A, rhs(A) (the right-hand side of A) is either a variable from X, 
one of the constants —1, 0, 1, or an expression of the form B + C or B ■ C, where 
B and C are gates. 

- There is a linear order < on V such that B < A whenever B occurs in rhs(A). 

A gate A, where rhs(A) has the form B + C (resp., B ■ C) is called an addition gate 
(resp., multiplication gate). A gate that is labelled with a variable or a constant is an 
input gate. 

Fix a ring ( R , +, •) (which will be (Z, +, •) in most cases) and assume that C = 
(V, S , rhs) is an arithmetic circuit in which the variables x\,...,x n occur. Then we can 
evaluate every gate A € V to a polynomial vale (A) £ R[x\,, x n \ in the obvious 
way (here,“val” stands for “value”). Moreover let val(C) = vale (S') be the polynomial 
to which C evaluates. Two arithmetic circuits C\ and C 2 are equivalent if they evaluate 
to the same polynomial. 

Fix an arithmetic circuit C = (V) S, rhs). We can view C as a directed acyclic graph 
(dag), where every node is labelled with a variable or a constant or an operator +, •. If 
rhs(A) : B o C (for o one of the operators), then there is an edge from B to A and C 
to A. The depth depth(A) (resp., multiplication depth mdepth(A)) of the gate A is the 
maximal number of gates (resp., multiplication gates) along a path from an input gate 
to A. So, input gates have depth one and multiplication depth zero. The depth (resp., 
multiplication depth) of C is depth(C) = depth(S) (resp., mdepth(C) = mdepth(S)). 
The formal degree deg(A) of a gate A is 1 if A is an input gate, max{deg(B), deg(C”)} 
if rhs(A) = B + C, and deg (B) + deg(C) if rhs(A) = B -C. The formal degree of C is 
deg(C) = deg(S). A positive circuit is an arithmetic circuit without input gates labelled 
by the constant — 1. An addition circuit is a positive circuit without multiplication gates. 
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A variable-free circuit is a circuit without variables. It evaluates to an element of the 
underlying ring. A skew circuit is an arithmetic circuit such that for every multiplication 
gate A with rhs(A) = B ■ C, one of the gates B , C is an input gate. 

In the rest of the paper we will also allow more complicated expressions in right- 
hand sides for gates. For instance, we may have a gate with rhs(A) = (B + C) • (D + 
E). When writing down such a right-hand side, we implicitly assume that there are 
additional gates in the circuit, with (in our example) right hand sides B + C and D + E, 
respectively. The following lemma is folklore. We give a proof for completeness. 

Lemma 1. Given an arithmetic circuit C one can compute in logarithmic space two 
positive circuits C\ and C 2 such that val(C) = val(Ci) — val(C 2 )/or every ring. More¬ 
over, for i G {1,2} we have deg(Cj) < deg(C), depth(Ci) < 2 • depth(C), and 
mdepth(Ci) < mdepth(C). 

Proof. Let C = ( V, S, rhs) be an arithmetic circuit. We define the positive circuits 
Ci = (V', Si, rhs') and C 2 = ( VS 2 , rhs') as follows: 

V = {Ai | A G V, i G {1,2}} , 
rhs'(A;) = Bi + Ci if rhs(A) = B + C for i G (1,2}, 
rhs^Ai) = B\C\ + B 2 C 2 if rhs(A) = B ■ C, 
rhs , (A 2 ) = BiC 2 + B 2 Ci if rhs(A) = B ■ C, 
rhs^Ai) = rhs(A) if rhs(A) G {0, 1} U X, 
rhs , (A 2 ) = 0 if rhs(A) G {0, 1} U X, 
rhs^Ai) = 0 if rhs(A) = —1, 
rhs , (A 2 ) = 1 if rhs(A) = —1. 

Now we show by induction that for every gate A G V we have val(A) = val(Ai) — 
val(A 2 ): The case that A is an input gate is trivial. Now let A be an addition gate with 
rhs(A) = B + C such that the statement is true for B and C. Then 

val(A) = val(f?) + val(C) 

= val(f?i) — val (f? 2 ) + val(Ci) — val(C 2 ) 

= (val( Bi) + val(C'i)) - (val (B 2 ) + val(C 2 )) 

= val(Ai) — val(A 2 ) 

Finally, let A be a multiplication gate with rhs(A) = B ■ C. We get 

val(A) = \iA(B)\ia\(C) 

= (vaKflO - val(S 2 ))(val(Ci) - val(C 2 )) 

= val(Bi)val(Ci) + val(B 2 )val(C 2 ) — val(i?i)val(C 2 ) — val(S 2 )val(C'i) 

= val(Ai) — val(A 2 ). 

So the claim holds. The construction of Ci and C 2 can be done in logarithmic space. 
By induction, it can be shown that for every gate A of C and every i G {1,2}, one has 
deg(Ai) = deg(A), depth(Ai) < 2 ■ depth(A), and mdepth(Ai) = mdepth(A). □ 
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Polynomial identity testing for a ring R is the following computational problem: Given 
an arithmetic circuit C (with variables xi,..., x n ), does val(C) = 0 hold, i.e., does C 
evaluate to the zero-polynomial in R[x i,..., x n ]l It is an outstanding open problem in 
algebraic complexity theory, whether polynomial identity testing for Z can be solved in 
polynomial time. 


3 Complexity classes 

The counting class # L consists of all functions / : £* —> N for which there is a 
logarithmic space bounded nondeterministic Turing machine M such that for every 
w £ £*, f(w ) is the number of accepting computation paths of M on input x. The 
class C_L contains all languages A for which there are two functions /i ,/2 £ #L 
such that for every w £ £*, w £ A if and only if fi(w) = The class C = L is 

closed under logspace many-one reductions. The canonical C = L-complete problem is 
the following: The input consists of two dags G i and G 2 and vertices si, t\ (in G\) and 
S' 2 - 1‘2 (in G 2 ), and it is asked whether the number of different paths from si to > \ in G\ 
is equal to the number of different paths from S 2 to <2 in G 2 . This problem is easily seen 
to be equivalent to the following problem: Given two variable-free addition circuits C\ 
and C 2 , does val(Ci) = valjTy hold? Several C = L-complete problem is the question 
whether the determinant of a given integer matrix is zero 0311321 . 

We use standard definitions concerning circuit complexity, see e.g. If33l for more de¬ 
tails. In particular we will consider the class TC° of all problems that can be solved by 
a polynomial size circuit family of constant depth that uses NOT-gates and unbounded 
fan-in AND-gates, OR-gates, and majority-gates. For DLOGTIME-uniform TC° it is 
required in addition that for binary coded gate numbers u and v, one can (i) com¬ 
pute the type of gate u in time 0(|u|) and (ii) check in time 0(\u\ + |r>|) whether u 
is an input gate for v. Note that the circuit for inputs of length n has at most p(n) 
gates for a polynomial p(n). Hence, the binary codings u and v have length 0(log n), 
i.e., the above computations can be done in DTIME(logn). This is the reason for us¬ 
ing the term “DLOGTIME-uniform”. If majority gates are not allowed, we obtain the 
class (DLOGTIME-uniform) AC 0 . The class (DLOGTIME-uniform) NC 1 is defined 
by (DLOGTIME-uniform) polynomial size circuit families of logarithmic depth that 
use NOT-gates and fan-in-2 AND-gates and OR-gates. A language A is AC°-reducible 
to languages B\,..., B^ if A can be solved with a DLOGTIME-uniform polynomial 
size circuit family of constant depth that uses NOT-gates and unbounded fan-in AND- 
gates, OR-gates, and Bi -gates (1 < 1 < k). Here, a 5,-gate (it is also called an oracle 
gate) receives an ordered tuple of inputs x\, X 2 , ■ ■ ■, x n and outputs 1 if and only if 
X 1 X 2 ■ ■ ■ x n £ /j ,. Sometimes, also the term “uniform constant depth reducibility” is 
used for this type of reductions. In the same way, the weaker NC 1 -reducibility can be 
defined. Here, one counts the depth of a Bi -gate with inputs x\,X 2 ,... ,x n as logn. 
The class DET contains all problems that are NC 1 -reducible to the computation of the 
determinant of an integer matrix, see m. It is known that C = L C DET C NC 2 , see 
e.g. j5] Section 4], 

An NAuxPDA is a nondeterministic Turing machine with an additional pushdown 
store. The class LogCFL C NC 2 is the class of all languages that can be accepted by 
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a polynomial time bounded NAuxPDA whose work tape is logarithmically bounded 
(but the pushdown store is unbounded). If we assign to the input the number of accept¬ 
ing computation paths of such an NAuxPDA, we obtain the counting class #LogCFL. 
In f32l it is shown that $LogCFL is the class of all functions / : {0,1}* —> N (a 
non-binary input alphabet E has to be encoded into {0,1}*) for which there exists a 
logspace-uniform family (C„) n >i of positive arithmetic circuits such thatC„ computes 
the mapping / restricted to {0,1}" and there is a polynomial p(n) such that the formal 
degree of C n is bounded by pin). The class C = LogCFL contains all languages A for 
which there are two functions fi, fi G #LogCFL such that for every w € E*, w € A 
if and only if fi(w) = f 2 .{w). We need the following simple lemma, whose proof is 
based on folklore ideas: 

Lemma 2. There is an NAuxPDA V that gets as input a positive variable-free arith¬ 
metic circuit C = (V, S, rhs) and such that the number of accepting computations 
of V on input C is val(C). Moreover, the running time is bounded polynomially in 
depth(C) ■ deg(C). 

Proof The NAuxPDA V stores a sequence of gates on its pushdown (every gate can be 
encoded using log(|Vj) many bits). In the first step it pushes the output gate S on the 
initially empty pushdown. If A is on top of the pushdown and rhs(A) = B + C, then V 
replaces A on the pushdown by B or C, where the choice is made nondeterministically. 
If rhs(A) = B ■ C, then V replaces A on the pushdown by BC. If rhs(A) = 0, then 
V terminates and rejects. Finally, if rhs(A) = 1, then V pops A from the pushdown. If 
thereby the pushdown becomes empty then V terminates and accepts. In addition to its 
pushdown, V only needs a logspace bounded work tape to store a single gate. Moreover, 
if we start V with only the gate A on the pushdown, then (i) the number of accepting 
computation paths from that configuration is exactly vale (A) and (ii) the number of 
pushdown operations along a computation path is bounded by depth (A) • deg(A). Both 
statements follow easily by induction. □ 

4 Matrices and groups 

Let A be a square matrix of dimension d over some commutative ring R. With A[i, j] 
we denote the entry of A in row i and column j. The matrix A is called triangular if 
A[i,j] = 0 whenever i > j, i.e., all entries below the main diagonal are 0. A unitri- 
angular matrix is a triangular matrix A such that A[i, i] = 1 for all 1 < i < d, i.e., 
all entries on the main diagonal are 1. We denote the set of unitriangular matrices of 
dimension d over the ring R by \JT It is well known that for every commutative 
ring R, the set UT,/(/() is a group (with respect to matrix multiplication). 

Let 1 < i < j < d. With T t _ 3 we denote the matrix from UT,/(/() such that 
Tj :J [i. j] = 1 and Tij[k,l\ = 0 for all k,l with 1 < k < l < d and (k, l) (fj)- 
The notation T- UJ does not specify the dimension d of the matrix, but the dimension 
will be always clear from the context. The group UTd(Z) is generated by the finite set 
Pd = {Ti , i+ 1 | 1 < i < d}, see e.g. (TT|. 

As usual we denote with [ x , y\ = x~ 1 y~ 1 xy the commutator of x and y. We will 
make use of the following lemma, which shows how to encode multiplication with 
unitriangular matrices. See ll24l for a proof. 
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Lemma 3. For all a, b £ Z and 1 <i<j<k<dwe have [T?j,T^ k \ = 


In this paper we are concerned with certain subclasses of linear groups. A group is 
linear if it is isomorphic to a subgroup of GL d{F) (the group of all invertible (d x d)- 
matrices over the field F) for some field F. 

A (ra-step) solvable group G is a group G, which has a a subnormal series G = 
G n > G n — i > G n - 2 > • • ■ > G\ > Go = 1 (i.e., Gi is a normal subgroup of Gj+i 
for all 0 < i < n — 1 ) such that every quotient Gi+i/Gi is abelian (0 < i < n — 1 ). 
If every quotient Gi+i/Gj is cyclic, then G is called polycyclic. The number of 0 < 
i < n — 1 such that G 1+ i /G, = Z is called the Hirsch length of G; it does not depend 
on the chosen subnormal series. If G l+ \ /G,; = Z for all 0 < i < n - 1 then G is 
called strongly polycyclic. A group is polycyclic if and only if it is solvable and every 
subgroup is finitely generated. Polycyclic groups are linear. More precisely, Auslander 
and Swan 1 1612911 proved that the polycyclic groups are exactly the solvable groups of 
integer matrices. 

For a group G its lower central series is the series G = G\ > G 2 > G 3 > • • • of 
subgroups, where G l+ \ = [Gi, G], which is the subgroup generated by all commutators 
[g, h] with g £ Gi and h £ G. Indeed, G l+ \ is a normal subgroup of Gi. The group G 
is nilpotent, if its lower central series terminates after finitely many steps in the trivial 
group 1. Every f.g. nilpotent group is polycyclic. We need the following results about 
nilpotent and solvable groups: 

Theorem 1 (Chapter 5 in |[27l ). Every subgroup and every quotient of a solvable 
(resp., nilpotent) group G is solvable (resp., nilpotent) again. 

Theorem 2 (Theorem 17.2.2 in lfl 8 l ). Every f.g. nilpotent group G has a torsion-free 
normal subgroup H of finite index (which is also f.g. nilpotent). 

Theorem 3 (Theorem 17.2.5 in Ifl 8 l ). For every torsion-free f.g nilpotent group G 
there exists d > 1 such that G can be embedded into UT^Z). 

A group G is called metabelian if the commutator subgroup [G, G] is abelian. In other 
words, the metabelian groups are the 2-step solvable groups. Even if G is f.g. metabelian, 
this does not imply that G is polycyclic, since [G, G] is not necessarily finitely gener¬ 
ated. 

Let G be a f.g. group and let G be finitely generated as a group by E. Then, as 
a monoid G is finitely generated by E U E~ 1 (where E~ l = {a -1 | a £ E} is a 
disjoint copy of E and a -1 stands for the inverse of the generator a £ E). Recall that 
the word problem for G is the following computational problem: Given a string w £ 
(Z , U27 _1 )*, does w evaluate to the identity of G. Kharlampovichproved that there exist 
finitely presented 3-step solvable groups with an undecidable word problem. On the 
other hand, for every f.g. linear group the word problem can be solved in deterministic 
logarithmic space by results of Lipton and Zalcstein Il20l and Simon 1(281 . This applies 
in particular to polycyclic groups. Robinson proved in his thesis that the word problem 
for a polycyclic group belongs to TC° {26], but his circuits are not uniform. Waack 
considered in {34l arbitrary f.g. solvable linear groups (which include the polycyclic 
groups) and proved that their word problems belong to logspace-uniform NC 1 . In the 
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appendix we combine Waack’s technique with the famous division breakthrough results 
by Hesse, Allender, and Barrington lfT4l to show that for every f.g. solvable linear group 
the word problem belongs to D LOGTIM E-uniform TC° (we decided to move this result 
to the appendix, sind the classical word problem for groups is not the main focus of this 
paper). 


5 Straight-line programs and the compressed word problem 

A straight-line program (briefly, SLP) is basically a multiplicative circuit over a monoid. 
We define an SLP over the finite alphabet E as a triple Q = (V. S, rhs), where V is a 
finite set of variables (or gates), S G V is the start variable (or output gate), and rhs 
maps every variable to a right-hand side rhs(A), which is either a symbol a G E, or 
of the form BC, where B . C G V. As for arithmetic circuits we require that there is a 
linear order <onk such that B < A, whenever B occurs in rhs(A). The terminology 
“(start) variable” (instead of “(output) gate”) comes from the fact that an SLP is quite 
often defined as a context-free grammar that produces a single string over E. This string 
is defined in the obvious way by iteratively replacing variables by the corresponding 
right-hand sides, starting with the start variable. We denote this string with valff/j. The 
unique string over E, derived from the variable A € V, is denoted with val g(A). We 
will also allow more general right-hand sides from (V" U E)*, but by introducing new 
variables we can always obtain an equivalent SLP in the above form. 

If we have a monoid M, which is finitely generated by the set E, then there exists 
a canonical monoid homomorphism h : E* —»• M . Then, an SLP Q over the alphabet 
E can be evaluated over the monoid M, which yields the monoid element /i(val((7)). 
In this paper, we are only interested in the case that the monoid M is a f.g. group G. 
Let G be finitely generated as a group by E. An SLP over the alphabet E U E~ l is 
also called an SLP over the group G. In this case, we will quite often identify the string 
val((7) G (E U E -1 )* with the group element g G G to which it evaluates. We will 
briefly write “val (Q) = g in G” in this situation. 

The main computational problem we are interested in is the compressed word prob¬ 
lem for a f.g. group G (with a finite generating set E ), briefly CWP(G). The input for 
this problem is an SLP Q over the alphabet EUE -1 , and it is asked whether val (Q) = 1 
in G (where of course 1 denotes the group identity). The term “compressed word prob¬ 
lem” comes from the fact that this problem can be seen as a succinct version of the clas¬ 
sical word problem for G, where the input is an explicitly given string w G (E\J A” 1 )* 
instead of an SLP-compressed string. 

The compressed word problem is related to the classical word problem. For in¬ 
stance, the classical word problem for a f.g. subgroup of the automorphism group of 
a group G can be reduced to the compressed word problem for G, and similar results 
are known for certain group extensions, see |[23l for more details. Groups, for which 
the compressed word problem can be solved in polynomial time are Il23l : finite groups, 
f.g. nilpotent groups, f.g. free groups, graph groups (also known as right-angled Artin 
groups or partially commutative groups), and virtually special groups, which are groups 
that have a finite index subgroup that embeds into a graph group. The latter groups form 
a rather large class that include for instance Coxeter groups, one-relator groups with 
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torsion, residually free groups, and fundamental groups of hyperbolic 3-manifolds. In 
[9l the parallel complexity of the compressed word problem (there, called the circuit 
evaluation problem) for finite groups was studied, and the following result was shown: 

Theorem 4 (|j9|). Lei G be a finite group. If G is solvable, then CWP(G) belongs to 
the class DET C NC 2 . If G is not solvable, then CWP(G) is P -complete. 

The following two results are proven in l23l . Recall that RP is the set of all problems A 
for which there exists a polynomial time bounded randomized Turing machine R such 
that: (i) if a : £ A then R accepts x with probability at least 1/2, and (ii) if x $. A 
then R accepts x with probability 0. The class coRP is the class of all complements of 
problems from RP. 

Theorem 5 (Theorem 4.15 in (23)). For every fg. linear group the compressed word 
problem belongs to the class coRP. 

This result is shown by reducing the compressed word problem for a f.g. linear group 
to polynomial identity testing for the ring Z. Also a kind of converse of Theorem [3 is 
shown in 1231 : 

Theorem 6 (Theorem 4.16 in ll23ll ). The problem CWP(Sl- 3 (Z)) and polynomial iden¬ 
tity testing for the ring Z are polynomial time reducible to each other. 

This result is shown by using the construction of Ben-Or and Cleve flOll for simulating 
arithmetic circuits by matrix products. 

6 The compressed word problem for finitely generated nilpotent 
groups 

The main result of this section is: 

Theorem 7. Let G/lfe a f.g. torsion-free nilpotent group. Then CWP(G) is com¬ 
plete for the class C = L. 

For the lower bound let G be a non-trivial f.g. torsion-free nilpotent group. Since G f 1, 
G contains Z. Hence, it suffices to prove the following: 

Lemma 4. CWP(Z) is hard for C = L. 

Proof. Clearly, an SLP Q over the generator 1 of Z and its inverse —1 is nothing else 
than a variable-free arithmetic circuit C without multiplication gates. Using LemmaQ] 
we can construct in logspace two addition circuits Ci and C 2 such that val(C) = 0 if and 
only if val(Ci) = val(C 2 ). Checking the latter identity is complete for C = L as remarked 
in Section [3 □ 

For the upper bound in Theorem[7J we use the fact that every torsion-free f.g. nilpotent 
group can be embedded into the group UTd(Z) for some d> 1 fl heoremQ])- Hence, it 
suffices to show the following result: 
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Lemma 5. For every d> 1, CWP(UTd(Z)) belongs to C = L. 

For the rest of this section let us fix a number d > 1 and consider the unitriangluar 
matrix group UTd(Z). Consider an SLP Q = (V, S , rhs) over the alphabet r,j U 
where is the finite generating set of UT^Z) from Section [4] Note that for every 
variable A £ V, val g(A) is a word over the alphabet 7^ U Ff 1 - We identify in the 
following this word with the matrix to which it evaluates. Thus, val g(A) £ UT^Z). 

Assume we have given an arithmetic circuit C. A partition 1+J™ : V, of the set of 
all multiplication gates of C is called structure-preserving if for all multiplication gates 
it, v of C the following holds: If there is a non-empty path from a to v in (the dag cor¬ 
responding to) C then there exist 1 < i < j < d such that u £ Vi and v £ V r In a first 
step, we transform our SLP Q in logarithmic space into a variable-free arithmetic circuit 
C of multiplication depth at most d such that Q evaluates to the identity matrix if and 
only if C evaluates to 0. Moreover, we also compute a structure-preserving partition of 
the multiplication gates of C. This partition will be needed for the further computations. 
The degree bound in the following lemma will be only needed in Section [7] 

Lemma 6. From the SLP Q = (V, S, rhs) we can compute in logspace a variable-free 
arithmetic circuit C with mdepth(C) < danddeg(C) < 2(ci—1), such that val(C?) = Id^ 
if and only //'val(C) = 0. In addition we can compute in logspace a structure-preserx’ing 
partition (+J ,. =1 V) of the set of all multiplication gates ofC. 

Proof The set of gates of the circuit C is 

W = { A, ., | A £ V, 1 < i < j < d} U {T}, 

where T is the output gate. The idea is simple: Gate A, :1 will evaluate to the matrix 
entry val g{A)[i,j\. To achieve this, we define the right-hand side mapping of the circuit 
Q (which we denote again with rhs) as follows: 

if rhs(^l) = M er d urp 
+ Cj,i + T,i<k<j Bi,k ■ c kd if rhs(A) — BC 

In the first line one has to notice that M[i,j] is one of the numbers —1, 0,1. The second 
line is simply the rule for matrix multiplication (A t j = Y^k =t i,kCk,j) taking into 
account that all matrices are unitriangular. 

Now, val(Q) is the identity matrix if and only if all matrix entries valp(S')[i, j] 
(1 < i < j < d) are zero. But this is the case if and only if the sum of squares 
Si <i<j<d va h(S)[i, j] 2 is zero. Hence, we finally define 

rhs(T)= £ SF 

Concerning the multiplication depth, note that the multiplication depth of the gate A t j 
is bounded by j — i: The only multiplications in rhs(A , :i ) are of the form B^kCkj (and 
these multiplications are not nested). Hence, by induction, the multiplication depth of 
Ai j is bounded by 1 + max{fc — i,j — k | i < k < j} = j — i. It follows that every 


10 


gate S h j has multiplication depth at most d — 1, which implies that the output gate T 
has multiplication depth at most d. 

Similarly, it can be shown by induction that deg(Ajj) < j — i. Hence, deg(Aij) < 
d — 1 for all 1 < i < j < d, which implies that the formal degree of the circuit is 
bounded by 2 (d — 1). 

The structure-preserving partition (+jf =1 V. of the set of all multiplication gates of 
C can be defined as follows: All gates corresponding to multiplications ll, k • Ckj in 
rhs(Ai j) are put into the set Finally, all gates corresponding to multiplications 
Sfj in rhs(T) are put into 14. It is obvious that this partition is structure-preserving. □ 


In a second step we apply Lemma[T|and construct from the above circuit C two variable- 
free positive circuits C\ and C 2 , both having multiplication depth at most d such that 
val(C) = val(Ci) — val(C 2 ). Hence, our input SLP Q evaluates to the indentity matrix 
if and only if val(Ci) = val(C 2 ). Moreover, using the construction from Lemma Q] it is 
straightforward to compute in logspace a structure-preserving partition (+J^ =1 14,» of the 
the set of all multiplication gates of Ck (k £ { 1, 2}). 

The following lemma concludes the proof that CWP(UT ( j(Z)) belongs to C = L. 


Lemma 7. Let d be constant. From a given variable-free positive circuit C of multipli¬ 
cation depth d together with a structure-preserving partition (jj i=1 V t of the set of all 
multiplication gates ofC, we can compute in logarithmic space a variable-free addition 
circuit T> such that val(C) = val(27). 


Proof Let C = (V, S , rhs) together with the partition V = l+jf =1 V as in the lemma. 
W.l.o.g. we can assume that there is a unique input gate whose right-hand side is 0 
(resp., 1) and we denote this gate simply with 0 (resp., 1). 

Since d is a constant, it suffices to construct in logarithmic space a variable-free 
positive circuit C' - ( V' , S. rhs 7 ) of multiplication depth d— 1 together with a structure¬ 
preserving partition V = l+J^Tj 1 V- of the set of all multiplication gates of C such that 
val(C) = val(C') (the composition of a constant number of logspace computations is 
again a logspace computation). 

To achieve the above goal, we eliminate in C all multiplication gates from Vi. Note 
that below these gates there are not other multiplication gates. Then, we define the set 

V- as Vi+i for 1 < i < d — 1. 

Let Vi = {Ai,..., A m } and assume that rhsc(Ai) = Bi ■ Ci. The set of gates of 
C is 


V' = V U {A (i) | A <E V, 1 < i < to}, 
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i.e., we add m copies of each gate to the circuit. We define the right-hand side mapping 
as follows: 


rhs'(A) = rhs (A) if Ae V \ Vi 
rhs'(Aj) = B^' 1 2 for 1 < i < m 


( 1 ) 

( 2 ) 

(3) 

(4) 

(5) 

( 6 ) 


rhs'(A (i) ) = B {i) + C (i) if A G V and rhs(A) =B + C 
rhs'(A (i) ) = Oif A e F and rhs (A) = B-C 


rhs'(0 (i) ) = 0 
rhs'(l w ) = Ci 


Note that A,; has only one incoming edge after this construction. To stick to our def¬ 
inition of arithmetic circuits, we can make Ai an addition gate, which gets another 
incoming edge from 0, and similarly for lW (the 7-th copy of the unique 1-gate). 

The idea of the above construction is the following: Basically, we add m many 
copies of the circuit C. In these copies, we do not need the multiplication gatesQ and 
since we do not want to introduce new multiplication gates, we set the right-hand side 
of a copy of a multiplication gate to 0, see ©[] Also notice that strictly below A, we 
only find addition gates and constants in the circuit C. In particular, the value va\c(B,) 
is equal to the number of paths from the unique 1-gate 1 to Bi and similarly for C,. 
We want to assign to gate A, the product of these path numbers. For this, we redirect 
the edges ( Bi,Ai ) and (Cj,Aj) of the multiplication gate for every 1 < i < m as 
follows: The edge (Ci,Af) is replaced by the edge (Ci, lW), see ©. Moreover, the 
edge (Bi, A,) is replaced by the edge (B < f' > , Ai) (which is the unique incoming edge to 
AA, see ©. So, basically, we serially connect the circuit part between 1 and Ci with 
the circuit part between 1 and B,■. Thereby we multiply the number of paths. The above 
construction can be clearly done in logspace. □ 

So far, we have restricted to torsion-free f.g. nilpotent groups. For general f.g. nilpotent 
groups, we use the fact that every f.g. nilpotent group contains a torsion-free normal 
f.g. nilpotent subgroup of finite index (Theorem© in order to show that the compressed 
word problem for every f.g. nilpotent group belongs to the complexity class DET: To 
do this we need the following result: 

Theorem 8. Let G be a finitely generated group. For every normal subgroup H of G 
with a finite index, CWP(G) is AC 0 -reducible to CWP(iT) and C\NP(G/H). 

Proof To show the lemma, we adopt the proof of j23l Theorem 4.4], where the state¬ 
ment is shown for polynomial time many-one reducibility instead of AC n -reducibility. 
Let G be a finitely generated group with the finite generating set E and let H be a 
normal subgroup of G of finite index (which must be f.g. as well) with the finite gen¬ 
erating set r. As the generating set for the quotient G/H we can take the set E as 

1 Actually, we only need in the z-th copy those nodes that belong to a path from the unique 1- 
gate to Bi. But we cannot compute the set of these nodes in logspace unless L = NL. Hence, 
we put all nodes into the copy. 

2 This is an arbitrary choice; instead of 0 we could have also taken 1. 
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well. Let { Hgi ,..., Hg n } be the set of cosets of H in G, where gi = 1. Moreover, 
let (f> : G —> G/H be the canonical homomorphism and let h : (E U i7 -1 )* —> G be 
the morphism that maps every word from (E U E~ x )* to the group element in G to 
which it evaluates. Now let Q = ( V, S , rhsq) be an SLP over the alphabet E\J E -1 . We 
have to construct an AC°-circuit with oracle gates for CWP(fT) and CWP(G/fT) that 
checks whether val (G) = 1 in G. 

Consider the set of triples 

W = {[gi, A^gJ 1 } | A £ V, 1 < i,j < n, gM^giA^gJ 1 £ H) . 

In a first step, we construct the set of all these triples using n 2 \V\ parallel CWP(G/ H)- 
oracle gates. More precisely, we construct for all A £ V, 1 < i, j < n an SLP Ga.i.j 
that evaluates to the group element cj){gih(\ia\g (A')')gJ l ) £ G/H. For this, we take the 
SLP G and add a new start variable Sa^j with the right-hand side w,Aiir where 
Wi £ (E U Z 1-1 )* is a word that represents the group element g,. We do not need 
to compute these words w t ; they can be “hard-wired” into the circuit. The SLP Ga.i.] 
can be clearly constructed in AC 0 , and we have m^\{Gaa, j) = 1 in G/H if and only if 
gih(\za\g(A))g~ 1 £ H. 

Note that val(C/s i i) = 1 in G/H if and only if val (G) represents an element of the 
subgroup H. Thus, if it turns out that vaI(Cs.i ,i) 7 ^ 1 in G/H , then the whole circuit 
will output zero. Otherwise (i.e., in case /i(val(C?)) £ H), we construct an SLP H over 
the alphabet r U L -1 (the monoid generating set for II) that will represent the group 
element A(val(C/)). 

The variable set of H is W. the start variable is [gi, S, g// 1 } and the right-hand sides 
are defined as follows: If rhs giyA) = a £ E U E~ x , we set rhs ui\gii A, gj 1 ]) = 
where w a ,i,j £ (f U L -1 )* is a word that represents the group element g^ag J 1 = 
gih(va\g(A))gJ 1 £ H. Note again, that we do not have to compute these words w a ,i,j 
(they are fixed). If rhsg(A) = BC and [g,, A , gj l \ £ W, then we determine the unique 
k, so that g i h{ya\g(B))g' k l £ H. To do this we have to go through the set W and 
look for the unique k such that [gt, B, g// 1 ] £ H. Now we define rhs n{[gii A 1 gj 1 ]) = 
[gi,B, g/I^lgk, C, gj 1 ] - Clearly, this construction can be carried out by an AC°-circuit. 
Finally, it is straightforward to show that \ia\u{[gi, A.,g~ ]) represents the group ele¬ 
ment gih(\ia\g(A))gJ 1 £ H. Hence, we have val(C?) = 1 in G, if and only if val("H) = 
1 in H. This finishes our reduction. Note that the overall circuit consists of n 2 \ V par¬ 
allel CWP(G/fF)-oracle gates followed by a single CWP(7T)-oracle gate. □ 

We can now show: 

Theorem 9. For every fig. nilpotent group, the compressed word problem is in DET. 

Proof. Let G be a f.g. nilpotent group. If G is finite, then the result follows from The¬ 
orem |4] (every nilpotent group is solvable). If G is infinite, then by Theorem [2] G has 
a torsion-free normal subgroup H of finite index. By Theorem □ H and G/H are 
nilpotent too; moreover H is finitely generated. By Theorem |7] CWP(// j belongs to 
C = L C DET. Moreover, by Theorem^] CWP(G/iT) belongs to DET as well. Finally, 
Theorem[ 8 ]implies that CWP(G) belongs to DET. □ 
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Actually, Theorem [9] can be slightly extended to groups that are (f.g. nilpotent)-by- 
(hnite solvable) (i.e., groups that have a normal subgroup, which is f.g. nilpotent, and 
where the quotient is finite solvable. This follows from Theorem[ 8 ]and the fact that the 
compressed word problem for a finite solvable group belongs to DET (Theorem[4]i. 

7 The uniform compressed word problem for unitriangular 
groups 

For Lemma[5]it is crucial that the dimension d is a constant. In this section, we consider 
a uniform variant of the compressed word problem for UT<j(Z). We denote this problem 
with CWP(UT*(Z)). The input consists of a unary encoded number d and an SLP, 
whose terminal symbols are generators of UTrf(Z) or there inverses. Alternatively, we 
can assume that the terminal symbols are arbitrary matrices from UT^Z) with binary 
encoded entries (given such a matrix M, it is easy to construct an SLP over the generator 
matrices that produces M). The question is whether the SLP evaluates to the identity 
matrix. We show that this problem is complete for the complexity class C_l_ogCFL. 

Theorem 10. The problem CWP(UT»(Z)) is complete for C = LogCFL. 

Proof. We start with the upper bound. Consider an SLP Q, whose terminal symbols 
are generators of UT d(Z) or there inverses. The dimension d is clearly bounded by 
the input size. Consider the variable-free arithmetic circuit C constructed from Q in 
Lemma[ 6 ]and let C\ and C 2 be the two variable-free positive arithmetic circuits obtained 
fromC using LemmaQ] Then Q evaluates to the identity matrix if and only if val(Ci) = 
val(C 2 ). Moreover, the formal degrees deg(Ci) and deg(C 2 ) are bounded by 2 (d — 1), 
i.e., polynomially bounded in the input length. Finally, we compose a logspace machine 
that computes from the input SLP Q the circuit C, with the NAuxPDA from Lemma [2] 
to get an NAuxPDA Vi such that the number of accepting computation paths of V L on 
input Q is exactly val(Cj). Moreover, the running time of V, on input Q is bounded 
polynomially in (2d — 1) • depth(Ci) £ 0(d ■ \Q\). 

Let us now show that CWP(UT*(Z)) is hard for C = LogCFL. Let (Ci t n)n>o and 
(C 2 , n )n>o be two logspace-uniform families of positive arithmetic circuits of polyno¬ 
mially bounded size and formal degree. Let w = aici 2 ■ ■ ■ a n £ {0, l} n be an input for 
the circuits C, \and C 2 , n - Let C, be the variable-free positive arithmetic circuit obtained 
from Cg n by replacing every Xj -labelled input gate by (ij £ {0,1}. By |4] Lemma 3.2] 
we can assume that every gate of Ci is labelled by its formal degree. By adding if nec¬ 
essary additional multiplication gates, where one input is set to 1 , we can assume that 
Ci and C 2 have the same formal degree d < p(n) for a polynomial p. Analogously, 
we can assume that if A is an addition gate in C\ or C 2 with right-hand side B + C, 
then deg (B) = deg(C) = deg(A). All these preprocessing steps can be carried out in 
logarithmic space. 

We will construct in logarithmic space an SLP Q over the alphabet I',j+i U T' d+1 , 
where TV|_i is our canonical generating set for the matrix group UTd + i(Z), such that 
Q evaluates to the identity matrix if and only if C\ and C 2 evaluate to the same number. 
Let Vi be the output value of C,. We first construct in logspace an SLP Q\ that evaluates 
to the matrix Tf\. In the same way we can construct in logspace a second SLP Gi 
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that evaluates to T x J 2 . Then, by concatenating the two SLPs Q \ and Q 2 we obtain the 
desired SLP. 

The variables of Qi are A\ ^ where A is a gate of C 1 , b £ {—1,1}, and 1 < i < 
j < d such that j — i is the formal degree of A. The SLP Q \ will be constructed in 
such a way that valc^ (A\^ = T^J, where v = val^ (A). If rhs^ (A) = 0, then we set 
rhsg 1 (vl^) = Id and if rhsc^H) = 1, then we set rhs•) = Tjf-. Correctness is 
obvious in these cases. If rhs^ ( A) = B + C, then we set rhs^ (A 1 ’ ■) = B\jC%j. Cor¬ 
rectness follows immediately by induction. Note that deg(f?) = deg(C) = deg(A) = 
j — i, which implies that the gates B 1 ’ ,■ and Cfj exist. Finally, if rhsc^A) = B ■ C, 
then we set rhs^^) = and rhs gAA~j) = C^B^Cl^Bl^, 

where k is such that deg(B) = k — i and deg(i3) = j — k. Such a k must exist since 
j — i = deg(A) = deg(-B) + deg(C). Correctness follows from Lemma[3]and induc¬ 
tion. □ 


8 The compressed word problem for polycyclic groups 


In this section we consider the compressed word problem for polycyclic groups. Since 
every polycyclic group is f.g. linear, the compressed word problem for a polycyclic 
group can be reduced to polynomial identity testing. In this section, we show a lower 
bound: There exists a strongly polycyclic group G (which is also metabelian) such that 
polynomial identity testing for skew arithmetic circuits can be reduced to CWP(G). 
Let us start with a specific example of a polycyclic group. Consider the two matrices 

3 “ = (o?) and/l= (oi)> (7) 

where a £ R, a > 2. Let G a = ( g a , h) < GI_ 2 (K). Let us remark that, for instance, the 
group G 2 is not polycyclic, see e.g. l35l p. 56]. On the other hand, we have: 


Proposition 1 . The group G = G 1+y /^ , ' v polycyclic and metabelian^ 

Proof. We show that the commutator subgroup of G is isomorphic to Z x Z, which 
implies the theorem. First we calculate the commutator subgroup of G. It is known that 
the commutator subgroup of a group generated by two elements <j \, gi is generated by 
all commutators gfglgf s gf l for s,t £ Z l25l . Hence, 


[G,G\ = (M s<t \s,t£Z), 


3 It is probably known to experts that G is polycyclic. Since we could not find an explicit proof, 
we present the arguments for completeness. 


15 



where for s, t £ Z we set 


M s ,t = 




1 l\ * 

.01 ) 

(l + v^) 8 oUiA, 

({1 + V2)- S O' 

) f 1 -*) 

o ly v° iy 

l 0 1 

Ao i) 

(l + v^) 8 t{l + V2) s \ 

i ((l + V2)~ s 

— 1( 1 + V2) 

0 1 ) 

V o 

1 

1 —t + i(l + \/2) s \ 

0 1/ 



1 f((l + V2) s — 1)\ 




With the setting 


1 V2 

0 1 


and v = 


1 2 
0 1 


we show that | s,t 6 Z) = (u,v). Moreover, it is easy to see that u and v 

generate a copy of Z x Z. 

We have Mi ) i = it and 




(l 2 + 2 ^^ (1 -2V2\ 

V° i Jlo 1 J 



= v. 


This shows that (u,v) C (M s . t | s,f S Z). For the other inclusion assume first that 
s > 0. Then 



we get 

= 'K' + ft'-D) = (J 2 ‘=‘ + ^«) = 
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For s < 0 we get with a = —s mod 2: 


f ((l + ^) S -l) =i^(\/2-l) 

= ‘(- 2 “+E(7) ( ^) i( - i r^) 

= t ^—2 a + 

tjz ( 2 r- 1 ) ( ^ )2i ~ i (-i )_s_(2i_i) 

i =1 ' ' 

2‘- 1 (-l)—“J + 

^ [E< 2 :_ s 1 )2-(- i )- < - i| I - 

So with 

c 1 = -at+Y,H 2i j 2* _1 (—l) _s_2i e z 
2—1 ' ' 

and 

C2 = E *( 2 ~- G Z 

we get 

M s , t = (j <((1 +^ 

This shows that (M s t | s, t G Z) C (u, u). □ 

The main result of this section is: 


= 2 —at 


L^J 

E* 

2=1 


— 5 

2 i 



Theorem 11. Let a > 2. Polyomial identity testing for skew arithmetic circuits is 
logspace-reducible to the compressed word problem for the group Ga¬ 
in particular, there exist polycyclic groups for which the compressed word problem 
is at least as hard as polynomial identity testing for skew circuits. Recall that it is not 
known, whether there exists a polynomial time algorithm for polynomial identity testing 
restricted to skew arithmetic circuits. 
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For the proof of TheoremfTTl we will make use of the following result from f3) (see 
the proof of Proposition 2.2 in |[3|, where the result is shown for a = 2, but the proof 
immediately generalizes to any a > 2 ): 

Lemma 8 . Let C be an arithmetic circuit of size n with variables Xi,..., x m and let 
p(x i,..., Xm) = val(C). Let a > 2 be a real number. Then p(x i,..., x„.) is the zero- 

oin 2 

polynomial if and only if p(a\,. .., a n ) = 0 , where oti = a 2 for 1 < i < to. 

Proof of Thereom [77] Let us fix a skew arithmetic circuit C of size n with m variables 
x \,..., x m . We will define an SLP Q over the alphabet {g ai gf 1 , h, h -1 } such that 
val(C7) = Id in G a if and only if val(C) = 0. First of all, using iterated squaring, we can 
construct an SLP ii with variables A |, Af 1 ..., A rn . Af 1 (and some other auxiliary 
variables) such that 



We now construct the SLP Q as follows: The set of variables of Q consists of the gates of 
C and the variables of 'H. We copy the right-hand sides from TL and define the right-hand 
side for a gate A of C as follows: 


'id 

h 


if rhsc(A) = 0 
if rhsc(A) = 1 
if rhsc(A) = — 1 


rhsp(A) = h 1 
BC 

ABAf 1 


if rhsc(A) = B + C 
if rhse(A) = x^ ■ B 


We claim that for every gate A of C we have the following, where we denote for better 
readability the polynomial vale (A) to which gate A evaluates with pa- 



The case that rhsc(^4) is a constant is obvious. If rhsc(^4) = B + C then we obtain by 
induction 


val g(A) = valp(f3)valp(C') 



1 p B {ui,- ■ ■, a n ) 

0 1 



1 Pc(a i,..., a n ) 

0 1 




1 Pa(cT1: • • - ; Ct n ) 

0 1 
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Finally, if rhsc(A) = Xi ■ B then we obtain by induction 

val g(A) = ^ a J ^ val g (B) ^ a, Q ^ 

(Q.i 0\ (\ p B {ai,...,a n )\ f af 1 0\ 

V° VV° 1 )\ 0 l) 

_ (a-i ai-p B {ai,...,a n )\ fof 1 0\ 

V 0 1 ){ 0 i) 

_ f 1 OLi ■Pb(oii ,... ,a n ) \ 

"Vo i ) 

(1 p J 4(ai,...,an)'\ 

Vo i )■ 

We finally take the output gate S of the skew circuit C as the start variable of Q. Then, 
val (£7) yields the identity matrix in the group G a if and only ifpg(ai,..., a n ) = 0. By 
Lemma[8]this is equivalent to val(C) = ps{x i,..., x n ) =0. □ 

Actually, we can carry out the above reduction for a class of arithmetic circuits that 
is slightly larger than the class of skew arithmetic circuits. Let us define a powerful 
skew circuit as an arithmetic circuit, where for every multiplication gate A, rhs(A) is of 
the form a ■ IIIVi X T ' B f° r a g ate B, binary coded integers a, ei,..., e m (e* > 0), 
and variables xi,, x m . Such a circuit can be converted into an ordinary arithmetic 
circuit, which, however is no longer skew. To extend the reduction from the proof of 
Thereom[TT]to powerful skew circuits, first note that in a right-hand side a ■ n Zx*v-b 
we can assume that a = 1, since we can obtain a ■ J][™ 1 xf ■ B from n™i *v-b 
using additional addition gates. For a gate A with rhsc(A) = YlrLi x T ' B we set 
rhsg(A) = Uti ^B niV , A~ ei . The powers A e f and A~ ei can be defined using 
additional multiplication gates. In our recent paper im, we introduced powerful skew 
circuits, and proved that for this class, polynomial identity testing can be solved in 
coRNC. We applied this result to the compressed word problem for wreath products. 

Let us look again at the group G = G 1+ ^ from Proposition [[] Its commutator 
subgroup is isomorphic to Z x Z. Moreover, the quotient G/[G, G ] is isomorphic to 
Z x 7j2'. The G-generator h from 0 satisfies h 2 £ [G, G], whereas the generator 
9i+V2 ^ as infinite order in the quotient. Hence, G has a subnormal series of the form 
G>iT>ZxZ>Z[>l, where H has index 2 in G and fT/(Z x Z) = Z. The group 
H is strongly polycyclic and has Hirsch length 3. By Theorem[8]we obtain: 

Corollary 1. There is a strongly polycyclic group H of Hirsch length 3 such that poly¬ 
nomial identity testing for skew circuits is polynomial time reducible to CWP(fT). 
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A The complexity of the classical word problem for finitely 
generated linear groups 

In this section we consider the ordinary (uncompressed) word problem for linear groups. 
The most important result in this context was shown by Lipton and Zalcstein li20l : 

Theorem 12. For every fig. linear group the word problem can be solved in determin¬ 
istic logarithmic space. 

By Tits alternative l30l . every linear group is either virtually solvable (i.e., has a solv¬ 
able subgroup of finite index, which can be assumed to be normal) or contains a free 
group of rank 2. Since by |[26] Theorem 6.3], the word problem for a free group of rank 
2 is hard for DLOGTIM E-uniform NC 1 , one gets: 

Theorem 13. For every fig linear group that is not virtually solvable, the word problem 
is hard for DLOGTIM ^.-uniform NC 1 . 

This leads to the question for the complexity of the word problem for a virtually solvable 
linear group. For the special case of a polycyclic group, Robinson |]26l Theorem 8.5] 
proved that the word problem belongs to TC°, but his circuits are not uniform. Waack 
proved in ll34l that the word problem for a virtually solvable linear group belongs to 
logspace-uniform NC 1 . Using the famous division breakthrough by Hesse et al. Ifl4l . 
we can improve Waack’s result in the following way: 

Theorem 14. For every fig. virtually solvable linear group G the word problem belongs 
to DLOGTIME -uniform NC 1 . If G is moreover infinite solvable, then the word problem 
is complete for DLOGTIM E-uniform TC°. 

For the proof, we first have to consider the complexity of iterated multiplication and 
division with remainder for polynomials in several variables. Recall that Z[xi,..., Xk] 
denotes the ring of polynomials in the variables x\,... ,Xk with coefficients from Z. 
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For a polynomial p £ Z[xi,..., Xfc] and a variable Xi we denote with deg^. (p) the 
maximal value d such that xf appears in a monomial of p. We specify polynomials 
from Z[xi,..., Xk\ by writing down for every non-zero term ax " 1 • • • x^f the tuple of 
integers (a, n\,..., rik), where a is represented in binary notation and the exponents 
are represented in unary notation. Iterated multiplication of polynomials in the ring 
Z[xi,..., Xk] is the task of computing from a given list of polynomials pi , p 2 ,..., p n £ 
Z[x’i,..., Xk] the product polynomial P 1 P 2 • • • p n ■ Division with remainder in the ring 
Z[x] (later, we will generalize this to several variables) is the task of computing for 
given polynomials s,t £ Z[x] such that t / 0 and the leading coefficient of t is 1 
the unique polynomials s mod t and s div t such that s = (s div t) ■ t + s mod t and 
deg(s mod t) < deg(i), where deg(p) denotes the degree of the polynomial t. 

The following result was shown in EES El 


Theorem 15 (c.f. H13I14I ). Iterated multiplication and division with remainder of poly¬ 
nomials in the ring Z[x] (respectively, F p [x]) belong to DLOGTIME -uniform TC°. 

We need generalizations of Lemma fl5l to multivariate polynomials. In the following 
proofs we always use the fact that iterated addition, iterated multiplication and division 
with remainder of binary coded integers can be done in DLOGTIM E-uniform TC° Ifl4l . 


Lemma 9. Iterated multiplication of polynomials in the ring Z[xi,...,Xfc] (respec¬ 
tively, F p [xi,..., Xk\) belongs to DLOGTI M ^.-uniform TC°. 

Proof. We only prove the result for Z[xi,..., Xfc]; exactly the same proof also works 
for F p [xi,... ,x k ). 

For d > 1 let Z[xi,... ,Xk\d C Z[xi,..., Xfc] be the set of all polynomials p £ 
Z[xi,... ,Xfc] such that deg x .(p) < d for all 1 < i < k. For d > 2 we define the 
mapping U d : Z[xi,..., x fc ] -> Z [z\ by 


U d (p(x i,x 2 , • •. ,Xfc)) = p(z d ° ,z d \ .. -,z dk ). 

The mapping Ud is also used in 12 to reduce polynomial identity testing to univariate 
polynomial identity testing. The mapping U d +\ restricted to Z[xi,..., Xk\ d is injective, 
since for a polynomial p £ Z[xi,..., Xk]d we obtain the polynomial U d +i{p) by re¬ 
placing for every monomial a■ x" 1 • • • x'Jf by the monomial a- z N , where N the number 
with base-(d + 1 ) expansion (m • • • rik) (with the most significant digit on the right). 
Moreover, for all polynomials p,q£ Z[xi,..., Xfc] and all d. > 2 we have 

Ud{p + q) = Udip) + Ud(q) and U d (pq) = U d (p)U d (q). (8) 

We can calculate U d (p) for a given polynomial p £ Z[xi,..., Xfc] and a given number 
d > 2 in DLOGTIME-uniform TC°: For a monomial ax " 1 • • • x^ k (which is repre¬ 
sented by the tuple (a, m,..., rik)) we have to compute the pair (a, X)i=o n i+i^ 1 ), 

4 Explicitly, the result is stated in M Corollary 6.5], where the authors note that Eberly’s reduc¬ 
tion 03 from iterated polynomial multiplication to iterated integer multiplication is actually 
an AC 0 -reduction, which yields a DLOGTI M E-uniform TC° bound with the main result from 

on. 


22 








which is possible in DLOGTIM E-uniform TC°. Similarly, we can compute (p) 
for a polynomial p £ U d - (-i(Z[xi,... ,Xk\ d )- in DLOGTIME-uniform TC U : From a 
given monomial az N (represented by the pair (a, N)) we have to compute the tuple 
(a, ni,..., rife), where n % = (N div (d + 1)* _1 ) niod (d + 1), which can be done in 
DLOGTIME-uniform TC°. 

We now multiply given polynomials pi,... ,p n £ Z[xi,..., Xk\ in the following 
way, where all steps can be carried out in DLOGTIME-uniform TC° by the above re¬ 
marks. 

1. Compute the number d = max{^” =1 deg Xi (pf) | 1 < j < fc}. This number 
bounds the degree of the product polynomial P 1 P 2 • • -p n in any of the variables 
xi,..., x n , i.e., p ± p 2 ■ p n C Z[xiX k ]d- 

2. Compute in parallel s,(z) = U d +i{pi) for 1 < i < n. 

3. Using Theorem IT5l compute the product S(z) = si(z)s 2 {z) ■ ■ ■ s n (z), which is 
U d+1 (pip 2 ■■■Pn) by ®. 

4. Finally, compute Uf +1 (S), which is P 1 P 2 ■■■ Pn- □ 

For polynomial division in several variables, we need a distinguished variable. There¬ 
fore, we consider the polynomial ring Z[xi,..., Xk, y\. We view polynomials from 
this ring as polynomials in the variable y, where coefficients are polynomials from 
Z[xi ,..., Xk\. We will only divide by a polynomial t for which the leading monomial 
p(x i,..., x n )y m of t satisfies p(x i,..., x n ) = 1. This ensures that the coefficients 
of the quotient and remainder polynomial are again in Z[a"i,.... xp ; ) (and not in the 
quotient field Q(a;i,..., x n )). 

Lemma 10. Division with remainder of polynomials in the ring ZJaq ,... ,Xh,y\ (re¬ 
spectively, F p [a"i,..., Xk, y\) belongs to DLOGTIM E-uniform T C°. 

Proof. Again, we only prove the result for Z[x\,... ,Xk,y]\ exactly the same proof 
works for F p [x- t , ...,Xk,y\ as well. As in the proof of Lemma [9] consider the set 
Z[xi,..., Xk, y]d Q Z[xi,..., Xk, y] of all polynomials in Z[x \,..., Xk,y] such that 
for every monomial a ■ xf 1 ■ ■ ■ x^ k y n we have m ,... ,nk,n < d, and the mapping 
U d : Z[xi,... ,x k ,y\ Z [z] with 

Ud(p{xi,x 2 ,...,xk,y)) =p{z d °,z d \...,z dk \z dk ). 

Note that for polynomials p, q £ Z[xi ,... ,Xk,y] d with deg (p) < deg {q) we have 
&eg(Ud+i(p)) < deglfld+x^q)), since the exponent of y becomes the most significant 
digit in the base-(cfTl) representation. Then, for all polynomials s, t £ Z[xi ,... ,Xk, y\ d 
(where the leading coefficient of t is 1) we have 

U d 2 +i(s mod t) = U d 2 +i( s ) moc l Md 2 +i(t)- 

To see this, assume that s = qt + r with deg y (r) < deg y (t), so that r = s mod t. 
We have q,r £ Z[xi,..., Xk, y]d 2 , which can be checked by tracing the polynomial 
division algorithm. By ® we have 


bld 2 + l(s) — bl d 2 + \{(l)ldd ' 2 + l{t) J rU d ' 2 +\(r). 
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Moreover, deg(W d 2 + 1 (r)) < deg(£Y d 2 + 1 (f)). Hence 

U d 2 + 1 (r) =U d 2 + 1 (s) modU d 2 + 1 (t). 


Now we can compute the remainders mod t for given polynomials s,t £ Z[xi ,... ,x k ,y\ 
(where the leading coefficient of t is 1) in DLOGTIME-uniform TC° as follows: 

1. Compute the number d = max{deg.(p) | p £ {s,t},z £ {xi,... ,Xk,y}}, so that 
s,t £ Z[z’i,.. .,x k ,y\ d . 

2. Compute in parallel u(z ) = U d 2 +1 (s) and v(z) = U d 2 +1 (t). 

3. Compute, using Theoremfl5l R(z ) = u(z) mod v(z), which is U d 2 + i(s mod f). 

4. Finally, compute Uff, x {R) which is s mod t. □ 

In the same way we can also compute the quotient, but we only will need the remainder 
s mod t in the following. 

Finally, we will also need the following result from (26] : 

Theorem 16 (Theorem 5.2 in (26l ). Let G be a f.g. group with a normal subgroup H 
of finite index. Then, the word problem for G is AC 0 -reducible to the word problems for 
H and G/H. 

Now we are in the position to prove Theorem fl4l 

Proof of TheoremU4\ Let us first assume that G is f.g. solvable and linear over a field F. 
By a theorem of Mal’cev (see e.g. |[35] Theorem 3.6]), G contains a normal subgroup H 
of finite index, which is triangularizable over a finite extension of F. Using TheoremfT6l 
we know that the word problem for G is AC 0 -reducible to the word problems for H and 
G/H. The latter is a finite solvable group, see Theorem Q] Hence, its word problem 
belongs to DLOGTIME-uniform TC° (actually ACC 0 ) by (8). 

By the previous discussion, it suffices to show that the word problem for a f.g. 
triangular matrix group G over some field F belongs to DLOGTIM E-uniform TC°. 
Let P be the prime field of F. We can replace F by the finitely generated extension 
of P that is generated by all matrix entries in generators of G. It is known that the 
field extension [F : I’ has a separating transcendence base {xi,..., x k }, which means 
that [F : P(x i,... ,£&)]' s a finite separable extension; see e.g. |f36l Theorem 31]@ 
Hence, the theorem of the primitive element applies, which says that F is generated 
over P(x i,..., Xk) by a single element a £ F, which is algebraic over P(x\ ,..., Xk). 

Assume now that P = Q (in case P = F p for a prime p we have to replace in all 
arguments below Z by F p ). Consider the minimal polynomial p(y) £ Q(xi,..., Xk ) \y\ 
of a. We can write it as 



Pm 

q 


( 9 ) 


forpi,... ,p m , q £ Z[xi,..., Xfc], q ^ 0 . The element ft = a ■ q £ F also generates F 
over P(x i,..., Xk), and its minimal polynomial is 


q(y) = y m +Pi- y m ~ l + pip ■ y m ~ 2 + • • • + e Z[s x ,...,x k ,y\ 


5 Every finitely generated extension field of a perfect field has a separating transcendence base 
and every prime field is perfect. 
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(multiply © by q m ). We have 


F = Q(xi,.. • ,x k )[y]/{q(y)), 

where (q(y)) = {a(x)-q(x) \ a{x) £ Q(xi,... , Xfc)[y]} is the ideal generated by q(x). 

Each of the finitely many generators of the group G is a matrix, whose entries are 
polynomials in the variable y with coefficients from the fraction field Q(xi,..., Xk). 
Every such coefficient is a fraction a(xi,..., Xk)/b(x i,..., Xk) with a(xi,..., Xk ), 
b{x i,..., Xk) £ Z[xi,..., Xk\. Let g(x i,..., Xk) be the greatest common divisor of 
all denominators b(x 1 ,..., Xk), which is a fixed polynomial. Instead of asking whether 
Ai ■ ■ ■ A n = Id mod q(y) (for group generators Ai,..., A n of G) we can ask whether 
gAi ■ ■ ■ gA n = g”ld mod ( 7 (y)@ So far, the proof has been following more or less 
closely Waack’s arguments from 041 . 

Let Mi = gAi , which is a triangular matrix of dimension d for some fixed d £ N 
with entries from Z[xi,..., Xk\- Let us write Mi = Di + Ui, where Di is a diagonal 
matrix and Ui is upper triangular with all diagonal entries equal to zero. We get 

n n 

M 1 ---M n =H(D i +u i )= ••• (io) 

i= 1 Xie{Di,!7i} X n e{D n ,Un} j= 1 

If there are more than d 1 factors LI, in a product YVj-i Xj, then the product is the 

zero matrix. So there are at most (T) — ^(d) — ^ n<i summands (for n > 2d) in 

the sum (TTTTb that are not equal to zero. When we look at one of the products TIjXi -X? 
with at most d — 1 many factors Ui, we can write it as 

mi —1 \ / m 2 — 1 \ / n 

n a Uu n a ) • • ■ Umi ( n °* 

2—1 / \ 2 =mi + l / + l 

1 U rni 1 ' * * 

for some 0 < l < d — 1 and 1 < toi <•••< mi < n, where D u>v = U Di 
(1 < u < u + 1, 0 < u < n) is a product of at most n diagonal matrices. Each of 
these products can be calculated by calculating d products of at most n polynomials 
from Z[xi,..., Xfc], which can be done in DLOGTIME-uniform TC° by Lemma [9] 
Moreover, all products D u ,. v for 1 < u < v < n can be computed in parallel. Once 
these products are computed, we can, in parallel, compute for all 0 < l < d — 1 and 1 < 
mi < • • • < mi < n the matrix product Di jmi _i/7 mi £) mi+ i !m2 _i • • • U mi D mi+ 
Note that these products have constant length and hence involve a constant number 
of polynomial multiplications and additions. So, all the above matrix products can be 
computed in DLOGTIME-uniform TC° as well. Next, we have to compute the sum 
of all polynomially many matrices computed in the previous step. For this we have to 
compute d 2 many sums of polynomially many polynomials, which is again possible in 
DLOGTIME-uniform TC°. The resulting matrix is Mi • • • M n = g " A \ ■ ■ ■ A n . Finally 
we have to reduce all entries of the matrices Mi • • • M n and g n Id modulo the minimal 

6 Here, for two (d x d)-matrices A and B, A = B mod q{x) means that A[i,j\ = B[i,j] mod 
q(x) for all 1 < i, j < d. 
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polynomial q(y) which can also be done in DLOGTIME-uniform TC° by Lemma flOl 
Note that we divide by the polynomial q(y), whose leading coefficient is indeed 1. 

Finally, let G be a f.g. virtually solvable linear group G. Then G contains a nor¬ 
mal solvable subgroup H, for which we know that the word problem can be solved in 
DLOGTIME-uniform TC°. Moreover, the quotient G/H is a finite group, for which the 
word problem belongs to DLOGTIME-uniform NC 1 . Hence, Theorem[T6limplies that 
the word problem for G belongs to DLOGTIME-uniform NC 1 . □ 
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